SLE 15 SP2 호스트에서 Active Directory 인증을 구성하려고 합니다. AD 도메인에는 여러 DC/AD 서버가 있습니다.
나는 다음 지침을 따랐습니다. https://www.suse.com/c/the-sssd-active-directory-and-sles-12-and-15/ https://www.suse.com/support/kb/doc/?id=000019549
특정 AD 서버를 사용하도록 호스트를 구성하면 모든 것이 잘 작동합니다. 그러나 다른 서버를 가져오도록 호스트를 구성하면 한동안 잘 작동하다가 작동이 중지됩니다. 아무 문제 없이 SSH를 통해 그룹의 AD 계정을 인증할 수 있지만 SSSD 서비스에서는 다음과 같은 오류가 여러 줄 표시됩니다.
"10월 12일 08:46:45 호스트 sssd[15569]: tkey 쿼리 실패: GSSAPI 오류: 주요 = 지정되지 않은 GSS 실패. 마이너 코드가 추가 정보를 제공할 수 있습니다. 마이너 = Kerberos 데이터베이스 서버에서 찾을 수 없습니다."
여러 사이트에서 여러 구성을 시도했지만 그 중 어느 것도 도움이 되지 않았습니다. 내가 뭘 잘못했나요?
감사해요!
구성 파일:
SSD 구성 파일
[sssd]
config_file_version = 2
services = nss,pam
domains = dom-ain.domain.com
[nss]
filter_users = root
filter_groups = root
[pam]
[domain/dom-ain.domain.com]
debug_level=6
id_provider = ad
auth_provider = ad
cache_credentials = false
enumerate = false
override_homedir = /home/%d/%u
case_sensitive = true
ad_hostname = host.dom-ain.domain.com
simple_allow_groups = [email protected]
access_provider = simple
krb5.conf
includedir /etc/krb5.conf.d
[libdefaults]
dns_canonicalize_hostname = false
rdns = false
default_realm = DOM-AIN.DOMAIN.COM
default_ccache_name = /tmp/krb5cc_%{uid}
dns_lookup_realm = false
dns_lookup_kdc = true
allow_weak_crypto = false
[domain_realm]
.dom-ain.domain.com = DOM-AIN.DOMAIN.COM
dom-ain.domain.com = DOM-AIN.DOMAIN.COM
[logging]
kdc = FILE:/var/log/krb5/krb5kdc.log
admin_server = FILE:/var/log/krb5/kadmind.log
default = SYSLOG:NOTICE:DAEMO
[realms]
DOM-AIN.DOMAIN.COM = {
default_domain = dom-ain.domain.com
}
LDAP 구성 파일
#
# LDAP Defaults
#
# See ldap.conf(5) for details
# This file should be world readable but not world writable.
#BASE dc=example,dc=com
#URI ldap://ldap.example.com ldap://ldap-master.example.com:666
URI ldap:// dom-ain.domain.com
BASE dc=doma-ain,dc=domain,dc=com
REFERRALS FF
#SIZELIMIT 12
#TIMELIMIT 15
#DEREF never
nsswitch.conf
#
# /etc/nsswitch.conf
#
# An example Name Service Switch config file. This file should be
# sorted with the most-used services at the beginning.
#
# The entry '[NOTFOUND=return]' means that the search for an
# entry should stop if the search in the previous entry turned
# up nothing. Note that if the search failed due to some other reason
# (like no NIS server responding) then the search continues with the
# next entry.
#
# Legal entries are:
#
# compat Use compatibility setup
# nisplus Use NIS+ (NIS version 3)
# nis Use NIS (NIS version 2), also called YP
# dns Use DNS (Domain Name Service)
# files Use the local files
# [NOTFOUND=return] Stop searching if not found so far
#
# For more information, please read the nsswitch.conf.5 manual page.
#
passwd: compat sss
group: compat sss
shadow: compat
hosts: files dns
networks: files dns
services: files
protocols: files
rpc: files
ethers: files
netmasks: files
netgroup: files nis
publickey: files
bootparams: files
automount: files nis
aliases: files
smb 구성 파일
# smb.conf is the main Samba configuration file. You find a full commented
# version at /usr/share/doc/packages/samba/examples/smb.conf.SUSE if the
# samba-doc package is installed.
#[global]
# workgroup = DOM-AIN
# passdb backend = tdbsam
# printing = cups
# printcap name = cups
# printcap cache time = 750
# cups options = raw
# map to guest = Bad User
# logon path = \\%L\profiles\.msprofile
# logon home = \\%L\%U\.9xprofile
# logon drive = P:
# usershare allow guests = Yes
[global]
workgroup = DOM-AIN
client signing = yes
client use spnego = yes
kerberos method = secrets and keytab
realm = DOM-AIN.DOMAIN.COM
security = ADS
create krb5 conf = no
[homes]
comment = Home Directories
valid users = %S, %D%w%S
browseable = No
read only = No
inherit acls = Yes
[profiles]
comment = Network Profiles Service
path = %H
read only = No
store dos attributes = Yes
create mask = 0600
directory mask = 0700
[users]
comment = All users
path = /home
read only = No
inherit acls = Yes
veto files = /aquota.user/groups/shares/
[groups]
comment = All groups
path = /home/groups
read only = No
inherit acls = Yes
[printers]
comment = All Printers
path = /var/tmp
printable = Yes
create mask = 0600
browseable = No
[print$]
comment = Printer Drivers
path = /var/lib/samba/drivers
write list = @ntadmin root
force group = ntadmin
create mask = 0664
directory mask = 0775